diff --git a/.opencode-sandbox/Dockerfile b/.opencode-sandbox/Dockerfile
index 240ff12..cc36dfd 100644
--- a/.opencode-sandbox/Dockerfile
+++ b/.opencode-sandbox/Dockerfile
@@ -7,6 +7,7 @@ RUN pacman -Syu --noconfirm && \
       npm \
       git \
       iptables \
+      openssh \
       opencode \
     && pacman -Scc --noconfirm
 
diff --git a/.opencode-sandbox/docker-compose.yml b/.opencode-sandbox/docker-compose.yml
index ae95456..df48f93 100644
--- a/.opencode-sandbox/docker-compose.yml
+++ b/.opencode-sandbox/docker-compose.yml
@@ -9,12 +9,11 @@ services:
       - NET_ADMIN   # required for iptables in entrypoint
       - NET_RAW
     volumes:
-      # Your monorepo — opencode's working directory
+      # Your monorepo
       - /home/ga/workspace:/workspace
-      # SSH key for Gitea auth
-      - ~/.ssh/id_ed25519:/root/.ssh/id_ed25519
-      - ~/.ssh/known_hosts:/root/.ssh/known_hosts:ro
-      # Persist opencode auth so you don't re-login every time
+      # Mount entire SSH directory from host
+      - /home/ga/.ssh:/root/.ssh
+      # Persist opencode auth
       - opencode-auth:/root/.local/share/opencode
     environment:
       - OPENCODE_API_KEY=${OPENCODE_API_KEY}
diff --git a/.opencode-sandbox/entrypoint.sh b/.opencode-sandbox/entrypoint.sh
index 82e417c..6a52be7 100644
--- a/.opencode-sandbox/entrypoint.sh
+++ b/.opencode-sandbox/entrypoint.sh
@@ -1,26 +1,22 @@
 #!/bin/bash
 
-# Fix SSH directory and key permissions
+# Fix SSH directory permissions
 chmod 700 /root/.ssh
 chmod 600 /root/.ssh/id_ed25519
 
-# Add Gitea server to known_hosts (suppress errors if network unavailable)
-ssh-keyscan -H git.processhub.work >> /root/.ssh/known_hosts 2>/dev/null || true
+# Copy known_hosts to tmp if it's read-only (from host mount)
+cp /root/.ssh/known_hosts /tmp/known_hosts 2>/dev/null || touch /tmp/known_hosts
+chmod 600 /tmp/known_hosts
 
-# Allow outbound SSH to Gitea
-GITEA_IP=$(getent hosts git.processhub.work | awk '{print $1}' | head -1)
-if [ -n "$GITEA_IP" ]; then
-    iptables -A OUTPUT -p tcp --dport 22 -d "$GITEA_IP" -j ACCEPT 2>/dev/null || true
-fi
+# Add Gitea to known_hosts
+ssh-keyscan -H git.processhub.work >> /tmp/known_hosts 2>/dev/null || true
 
-# Configure SSH to use the correct key
-export GIT_SSH_COMMAND="ssh -i /root/.ssh/id_ed25519 -o StrictHostKeyChecking=accept-new"
+# Configure SSH
+export GIT_SSH_COMMAND="ssh -i /root/.ssh/id_ed25519 -o UserKnownHostsFile=/tmp/known_hosts -o StrictHostKeyChecking=accept-new"
 
-# Configure git user
+# Git config
 git config --global user.email "gabriel.pereira@protonmail.com"
 git config --global user.name "gabspereira"
-
-# Configure git safe directory (system-wide + workspace specific)
 git config --system --add safe.directory '*'
 git config --global --add safe.directory /workspace